Critical Security Update for BIND 9.16: Memory Exhaustion and Denial of Service Vulnerabilities
Summary
ALSA-2026:23360: Important: bind9.16 security update. Affects bind9.16 versions < 32:9.16.23-0.22.el8_10.6. Fixed in 32:9.16.23-0.22.el8_10.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BIND (Berkeley Internet Name Domain) is a widely used implementation of the Domain Name System (DNS) protocols, providing essential services for domain name resolution. It includes a DNS server (named), a resolver library, and various tools for DNS server verification. BIND 9.16 is a specific version that has been identified to contain critical vulnerabilities that could lead to service disruptions.
Vulnerability Detail
The vulnerabilities in BIND 9.16 include a memory exhaustion issue during GSS-API TKEY negotiation (CVE-2026-3039) and a Denial of Service (DoS) vulnerability caused by specially crafted DNS messages (CVE-2026-5946). These vulnerabilities can be exploited by attackers to exhaust server resources or crash the DNS service, leading to significant disruptions in DNS resolution and potential downtime for dependent services.
How To Fix
Minimum fixed version
32:9.16.23-0.22.el8_10.6
This is the first release that contains the fix.
sudo dnf update bind9.16Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the exposure of your DNS server by implementing firewall rules to restrict access to trusted IP addresses only. Additionally, consider disabling GSS-API TKEY negotiation if it is not required for your environment.
Conclusion
The vulnerabilities in BIND 9.16 pose significant risks to DNS services, making it crucial for users to update to the patched version promptly. Implementing workarounds can provide temporary relief, but a full update is the best course of action to ensure security.
See every vulnerability recorded for bind9.16 →
FAQ
BIND is an implementation of the DNS protocols, providing a DNS server and resolver library for domain name resolution.
Exploitation of these vulnerabilities can lead to memory exhaustion and Denial of Service, causing disruptions in DNS services.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, implement firewall rules to restrict access and consider disabling unnecessary features like GSS-API TKEY negotiation.
For more details, refer to the CVE pages for CVE-2026-3039 and CVE-2026-5946.
Related vulnerabilities
Recent vulnerabilities recorded for bind9.16.
